An emergency treatment system and an emergency treatment method for network security events

Abstract

The invention relates to an emergency disposal system and an emergency disposal method for network security events. The system comprises a data collection module, an event management module, an eventdisposal module, an auxiliary tool module and an expert knowledge base module. The basic information of network security event is input and the security detection is carried out by using auxiliary tool module, The data acquisition module collects information, searches implanted files by using auxiliary tool module and inputs them into the system, the event disposal module analyzes and obtains theclue tree and attacker information, confirms the analysis results based on the information of expert knowledge base module, determines the nature of the event, draws the rectification suggestions andissues the event disposal report, and rectifies the event. The invention establishes a standard network safety incident emergency treatment process, standardizes the incident treatment means and method, improves the treatment efficiency, avoids the expansion of harm, reduces the economic loss, integrates information collection, analysis and rectification into one, automatically analyzes, generatesrectification suggestions, generates reports, retains the treatment results, and facilitates access.

Description

technical field [0001] The invention relates to the technical field of data exchange networks, in particular to an emergency response system and emergency response method for network security incidents, which streamline and systematize the emergency treatment of network security incidents. Background technique [0002] In today's society, the Internet has formed a scale, which is changing people's study, work and lifestyle more and more profoundly, and even affects the entire social process. The application of the Internet is becoming diversified, and the scale of Internet users continues to show a trend of sustained and rapid development. [0003] At this stage, my country's network security situation is becoming increasingly severe and complex, network security incidents are also more complex, and attack methods are more diverse. Faced with this situation, various enterprises or organizations are often helpless. They can only passively add some firewalls and anti-virus Tro...

AI Technical Summary

Problems solved by technology

[0010] The technical problem solved by the present invention is that in the prior art, the emergency response process of network security incidents has not been standardized and unified, resulting in unstable emergency response efficiency of network security incidents, inconsistent processing procedures, and inaccurate processing results , for this reason, the present invention provides an optimized emergency response system and emergency response method for network security incidents